181.115.171.215📋 Copy

# IP Intelligence Briefing: 181.115.171.215/32

Classification: Moderate Risk - Residential Endpoint

Date: Current

Risk Score: 55/100

## Executive Summary

IP address 181.115.171.215 is classified as a residential endpoint associated with EMPRESA NACIONAL DE TELECOMUNICACIONES SOCIEDAD ANONIMA (ENTEL), ASN 6568. The IP presents moderate risk (55/100) with no active threat indicators but is listed on 3 of 8 DNSBLs. Neighborhood analysis reveals elevated abuse density (0.056) with 2 high-risk and 20 medium-risk IPs in the /24 subnet, indicating potential coordinated activity or shared infrastructure risk.

## Ownership and Infrastructure

## Threat Assessment

Positive Indicators:

• No active threat indicators detected
• Not identified as Tor exit node, proxy, VPN, or hosting service
• No known campaigns or attacker reputation
• Zero honeypot hits

Negative Indicators:

• Listed on 3 DNSBLs (out of 8 total)
• Route stability: false (potential routing instability)
• Operator score: 0.1304 (Minimal)
• Geolocation consensus: false (data inconsistency between profile and history)

## Neighborhood Analysis

Subnet: 181.115.171.215/24

Total Siblings: 36

Abuse Density: 0.056 (Moderate)

High-Risk Neighbors (Risk Score 70-80):

• 181.115.171.100 (70)
• 181.115.171.103 (70)
• 181.115.171.104 (80)
• 181.115.171.111 (70)
• 181.115.171.118 (70)
• 181.115.171.119 (70)
• 181.115.171.153 (70)
• 181.115.171.217 (70)
• 181.115.171.221 (80)

Medium-Risk Neighbors (Risk Score 55):

Multiple IPs including 181.115.171.92, 181.115.171.97, 181.115.171.110, 181.115.171.125, 181.115.171.147, 181.115.171.151, 181.115.171.164, 181.115.171.194, 181.115.171.205, 181.115.171.219, 181.115.171.220

## Historical Observations

Twelve observations recorded. Recent signals confirm residential classification with consistent organization attribution. Notable: Geolocation data shows inconsistencies between Peru (PE) and Bolivia (BO) attributions across observation periods, indicating potential data quality issues or multi-country routing.

## Recommended Security Actions

Immediate:

• Increase logging verbosity for this IP
• Consider blocking based on risk score (55/100)

Firewall Rules:

```bash

# iptables

iptables -A INPUT -s 181.115.171.215 -j DROP

# nftables

nft add rule inet filter input ip saddr 181.115.171.215 drop

# Cloudflare WAF

{"description":"Block 181.115.171.215 — IPDebrief risk score 55","action":"block","filter":{"expression":"ip.src eq 181.115.171.215"}}

```

Note: These recommendations are probabilistic and should be combined with other signals before taking action. Monitor for any changes in behavior or risk profile.

## Key Intelligence Indicators

1. Neighborhood Correlation: 9 high-risk IPs in same /24 subnet suggest potential abuse infrastructure or shared compromised devices

2. Geolocation Inconsistency: Data conflicts between PE and BO locations require verification

3. Route Instability: BGP prefix 181.115.160.0/20 shows routing instability

4. Residential Profile: Likely legitimate endpoint but elevated risk due to neighborhood context

Recommendation: Monitor for pattern changes. Consider broader subnet monitoring for 181.115.171.0/24 given the concentration of high-risk addresses.

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.